Overview
Several new state privacy laws take effect in 2024 that will require changes to existing programs. McDermott’s Global Privacy & Cybersecurity Group highlights some of the biggest changes below.
In Depth
CALIFORNIA
On March 29, 2024, the amended California Consumer Privacy Act (CCPA) regulations will take effect. These regulations were originally slated to take effect in 2023, but a court ruling (that is being appealed) delayed the effective date by 12 months. Our prior alert summarized these soon-to-be enforceable regulations, which cover topics ranging from data subject requests to dark patterns. Companies that have not yet addressed these regulations should do so as soon as possible.
The California Privacy Protection Agency (CPPA) also proposed regulations covering major new topics, including:
- Privacy risk assessments
- Cybersecurity audit
- Artificial intelligence and automated decisionmaking technology
- Changes to the existing CCPA regulations
- Rules for insurance companies
Formal rulemaking technically has not yet started on these topics but likely will in the next few months. The regulations would impose significant operational burdens, so companies should start assessing how they will comply now.
COLORADO
On December 29, 2023, the Colorado Attorney General announced that it selected the Global Privacy Control (GPC) as the first universal opt-out mechanism that it will prioritize for enforcement. This means companies subject to the Colorado Privacy Act must recognize GPC signals by July 1, 2024.
OTHER SIGNIFICANT UPDATES
A number of new state laws will come into effect in 2024:
- Washington State’s My Health My Data Act (additional requirements effective March 1, 2024)
- The Texas Data Privacy and Security Act (July 1, 2024)
- Florida Digital Bill of Rights (July 1, 2024)
- Oregon Consumer Privacy Act (July 1, 2024)
- Montana Consumer Data Privacy Act (October 1, 2024)
These laws have nuanced differences from state privacy laws already in effect (in California, Colorado, Connecticut, Virginia and Utah) that will require a gap analysis from current practices in order to ensure compliance.
As an increasing number of states continue to bring privacy laws and regulations into effect, compliance will become even more complex. Companies should expect increased regulatory scrutiny and activity in this field over the course of the upcoming year. Indeed, New Hampshire is close to enacting the next state privacy law.
For a visual representation and quick reference guide to the ever-growing patchwork of state privacy laws, visit our state privacy law map.
If you have questions about the upcoming state privacy law requirements or other privacy concerns, please reach out to your McDermott lawyer or contact the authors.
